Features such as Credential Guard uses virtualization based security to protect secrets that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Virtualization based security and Credential Guard are only available with Windows 10 Enterprise.

Verify domain-joined systems are using Windows 10 Enterprise Edition. For standalone systems, this is NA. Verify the version of Windows 10 is Enterprise. Run "System Information". Under "System Summary", verify "OS Name" = Microsoft Windows 10 Enterprise. If another version of Windows 10 is reported, this is a finding.

Use Windows 10 Enterprise for domain-joined systems.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Installation options for applications are typically controlled by administrators. This setting prevents users from changing installation options that may bypass security features.

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: EnableUserControl Value Type: REG_DWORD Value: 0

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Allow user control over installs" to "Disabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Credential Guard uses virtualization based security to protect secrets that could be used in credential theft attacks if compromised. There are a number of system requirements that must be met in order for Credential Guard to be configured and enabled properly. Without a TPM enabled and ready for use, Credential Guard keys are stored in a less secure method using software.

Verify domain-joined systems have a TPM enabled and ready for use. For standalone systems, this is NA. Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop. For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. Verify the system has a TPM and is ready for use. Run "tpm.msc". Review the sections in the center pane. "Status" must indicate it has been configured with a message such as "The TPM is ready for use" or "The TPM is on and ownership has been taken". TPM Manufacturer Information - Specific Version = 2.0 or 1.2 If a TPM is not found or is not ready for use, this is a finding.

For standalone systems, this is NA. Virtualization based security, including Credential Guard, currently cannot be implemented in virtual desktop implementations (VDI) due to specific supporting requirements including a TPM, UEFI with Secure Boot, and the capability to run the Hyper-V feature within the virtual desktop. For VDIs where the virtual desktop instance is deleted or refreshed upon logoff, this is NA. Ensure domain-joined systems must have a Trusted Platform Module (TPM) that is configured for use. (Versions 2.0 or 1.2 support Credential Guard.) The TPM must be enabled in the firmware. Run "tpm.msc" for configuration options in Windows.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Standard user accounts must not be granted elevated privileges. Enabling Windows Installer to elevate privileges when installing applications can allow malicious persons and applications to gain full control of a system.

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: AlwaysInstallElevated Value Type: REG_DWORD Value: 0

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Always install with elevated privileges" to "Disabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Web-based programs may attempt to install malicious software on a system. Ensuring users are notified if a web-based program attempts to install software allows them to refuse the installation.

The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. If the registry value name below does not exist, this is not a finding. If it exists and is configured with a value of "0", this is not a finding. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Installer\ Value Name: SafeForScripting Value Type: REG_DWORD Value: 0 (or if the Value Name does not exist)

The default behavior is for Internet Explorer to warn users and select whether to allow or refuse installation when a web-based program attempts to install software on the system. If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Installer >> "Prevent Internet Explorer security prompt for Windows Installer scripts" to "Not Configured" or "Disabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Windows can be configured to automatically sign the user back in after a Windows Update restart. Some protections are in place to help ensure this is done in a secure fashion; however, disabling this will prevent the caching of credentials for this purpose and also ensure the user is aware of the restart.

If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Value Name: DisableAutomaticRestartSignOn Value Type: REG_DWORD Value: 1

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Logon Options >> "Sign-in last interactive user automatically after a system-initiated restart" to "Disabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Basic authentication uses plain text passwords that could be used to compromise a system.

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowBasic Value Type: REG_DWORD Value: 0

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow Basic authentication" to "Disabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

If data at rest is unencrypted, it is vulnerable to disclosure. Even if the operating system enforces permissions on data access, an adversary can remove non-volatile memory and read it directly, thereby circumventing operating system controls. Encrypting the data ensures that confidentiality is protected even when the operating system is not running.

Verify mobile systems employ DoD-approved full disk encryption. If full disk encryption is not implemented, this is a finding. If BitLocker is used, verify it is turned on for the operating system drive and any fixed data drives. Open "BitLocker Drive Encryption" from the Control Panel. If the operating system drive or any fixed data drives have "Turn on BitLocker", this is a finding.

Install an approved DoD encryption package and enable full disk encryption on mobile systems. BitLocker can be enabled in "BitLocker Drive Encryption" in the Control Panel.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowUnencryptedTraffic Value Type: REG_DWORD Value: 0

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Allow unencrypted traffic" to "Disabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Digest authentication is not as strong as other options and may be subject to man-in-the-middle attacks.

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Client\ Value Name: AllowDigest Value Type: REG_DWORD Value: 0

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Client >> "Disallow Digest authentication" to "Enabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

An approved tool for continuous network scanning must be installed and configured to run. Without the use of automated mechanisms to scan for security flaws on a continuous and/or periodic basis, the operating system or other system components may remain vulnerable to the exploits presented by undetected software flaws. To support this requirement, the operating system may have an integrated solution incorporating continuous scanning using HBSS and periodic scanning using other tools, as specified in the requirement.

Determine if an approved tool capable of continuous scanning is loaded on the system. The recommended system is the McAfee HBSS. If no such tool is installed on the system, this is a finding.

Install an approved HBSS solution onto the system.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Utilizing a whitelist provides a configuration management method for allowing the execution of only authorized software. Using only authorized software decreases risk by limiting the number of potential vulnerabilities. The organization must identify authorized software programs and only permit execution of authorized software. The process used to identify software programs that are authorized to execute on organizational information systems is commonly referred to as whitelisting.

This is applicable to unclassified systems, for other systems this is NA. Verify the operating system employs a deny-all, permit-by-exception policy to allow the execution of authorized software programs. This must include packaged apps such as the universals apps installed by default on systems. If an application whitelisting program is not in use on the system, this is a finding. Configuration of whitelisting applications will vary by the program. AppLocker is a whitelisting application built into Windows 10 Enterprise. A deny-by-default implementation is initiated by enabling any AppLocker rules within a category, only allowing what is specified by defined rules. If AppLocker is used, perform the following to view the configuration of AppLocker: Run "PowerShell". Execute the following command, substituting [c:\temp\file.xml] with a location and file name appropriate for the system: Get-AppLockerPolicy -Effective -XML > c:\temp\file.xml This will produce an xml file with the effective settings that can be viewed in a browser or opened in a program such as Excel for review. Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" under the Microsoft Windows section of the following link: https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml

This is applicable to unclassified systems, for other systems this is NA. Configure an application whitelisting program to employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs. Configuration of whitelisting applications will vary by the program. AppLocker is a whitelisting application built into Windows 10 Enterprise. If AppLocker is used, it is configured through group policy in Computer Configuration >> Windows Settings >> Security Settings >> Application Control Policies >> AppLocker. Implementation guidance for AppLocker is available in the NSA paper "Application Whitelisting using Microsoft AppLocker" under the Microsoft Windows section of the following link: https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/operating_systems.shtml

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Basic authentication uses plain text passwords that could be used to compromise a system.

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowBasic Value Type: REG_DWORD Value: 0

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow Basic authentication" to "Disabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities which leaves them subject to exploitation. Windows 10 is maintained by Microsoft at servicing levels for specific periods of time to support Windows as a Service. The Current Branch (CB) is the only option for consumer versions and will be maintained for approximately 4 months before a new CB is declared. Only the current CB is serviced with updates. Professional and Enterprise versions may select the Current Branch for Business (CBB) which is declared at the end of a Current Branch period and will be maintained for approximately 8 additional months. There will only be 2 CBBs active at any given time which will be serviced with updates. A separate servicing branch intended for special purpose systems is the Long-Term Servicing Branch (LTSB) which will receive security updates for 10 years but excludes feature updates. Systems using an LTSB version may not be able to meet all requirements of the STIG as new features are added, which organizations will need to address.

Run "winver.exe". If the "About Windows" dialog box does not display: "Microsoft Windows Version 1511 (OS Build 10586.0)" or greater, this is a finding. No preview versions will be used in a production environment. The initial release of the Windows 10 STIG is based on the Windows 10 November Update. Until the next update is released, the version referenced above is the minimum required for both the Current Branch (CB) and Current Branch for Business (CBB). Special purpose systems using the Long-Term Servicing Branch (LTSB) must be at "Version 10.0 (OS Build 10240)" or greater. If LTSB versions are not at Build 10240 or greater, this is a finding.

Update systems on the Current Branch (CB) or Current Branch for Business (CBB) to "Microsoft Windows Version 1511 (OS Build 10586.0)" or greater. Special purpose systems using the Long-Term Servicing Branch (LTSB) must be at Version 10.0 (OS Build 10240)" or greater.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Antivirus programs are a primary line of defense against the introduction of viruses and malicious code that can destroy data and even render a computer inoperable. Utilizing an antivirus program provides the ability to detect malicious code before extensive damage occurs. Updated virus scan data files help to protect a system, since new malware are identified by the software vendors on a continual basis.

If V-19910 from an antivirus STIG has been applied to the system, the signature verification portion of this requirement is NA. Verify a supported DoD antivirus product has been installed on the system. If McAfee VirusScan Enterprise 8.8 Patch 6 or later is not installed on the system, this is a finding. or If a product other than McAfee VirusScan Enterprise is used and V-19910 from an antivirus STIG has not been applied to the system, verify the date of the antivirus signature. If the antivirus program signature has not been updated within the past 7 days, this is a finding. The version numbers and the date of the signature can generally be checked by starting the antivirus program. The information may appear in the antivirus window or be available in the Help >> About window. The location varies from product to product.

Install McAfee VirusScan Enterprise 8.8 Patch 6 or later on the system. Update the signature file at least every 7 days.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

The ability to set access permissions and auditing is critical to maintaining the security and proper access controls of a system. To support this, volumes must be formatted using the NTFS file system.

Run "Computer Management". Navigate to Storage >> Disk Management. If the "File System" column does not indicate "NTFS" for each volume assigned a drive letter, this is a finding.

Format all local volumes to use NTFS.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Allowing other operating systems to run on a secure system may allow security to be circumvented.

Verify the system does not include other operating system installations. Run "Advanced System Settings". Select the "Advanced" tab. Click the "Settings" button in the "Startup and Recovery" section. If the drop-down list box "Default operating system:" shows any operating system other than Windows 10, this is a finding.

Ensure Windows 10 is the only operating system on a device. Remove alternate operating systems.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Shares which provide network access, should not typically exist on a workstation except for system-created administrative shares, and could potentially expose sensitive information. If a share is necessary, share permissions, as well as NTFS permissions, must be reconfigured to give the minimum access to those accounts that require it.

Non system-created shares should not typically exist on workstations. If only system-created shares exist on the system this is NA. Run "Computer Management". Navigate to System Tools >> Shared Folders >> Shares. If the only shares listed are "ADMIN$", "C$" and "IPC$", this is NA. (Selecting Properties for system-created shares will display a message that it has been shared for administrative purposes.) Right click any non-system-created shares. Select "Properties". Select the "Share Permissions" tab. Verify the necessity of any shares found. If the file shares have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding. Select the "Security" tab. If the NTFS permissions have not been reconfigured to restrict permissions to the specific groups or accounts that require access, this is a finding.

If a non system-created share is required on a system, configure the share and NTFS permissions to limit access to the specific groups or accounts that require it. Remove any unnecessary non-system created shares.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Outdated or unused accounts provide penetration points that may go undetected. Inactive accounts must be deleted if no longer necessary or, if still required, disable until needed.

Run "PowerShell". Copy the lines below to the PowerShell window and enter. "([ADSI]('WinNT://{0}' -f $env:COMPUTERNAME)).Children | Where { $_.SchemaClassName -eq 'user' } | ForEach { $user = ([ADSI]$_.Path) $lastLogin = $user.Properties.LastLogin.Value $enabled = ($user.Properties.UserFlags.Value -band 0x2) -ne 0x2 if ($lastLogin -eq $null) { $lastLogin = 'Never' } Write-Host $user.Name $lastLogin $enabled }" This will return a list of local accounts with the account name, last logon, and if the account is enabled (True/False). For example: User1 10/31/2015 5:49:56 AM True Review the list to determine the finding validity for each account reported. Exclude the following accounts: Built-in administrator account (Disabled, SID ending in 500) Built-in guest account (Disabled, SID ending in 501) Built-in DefaultAccount (Disabled, SID ending in 503) Local administrator account If any enabled accounts have not been logged on to within the past 35 days, this is a finding. Inactive accounts that have been reviewed and deemed to be required must be documented with the ISSO.

Regularly review local accounts and verify their necessity. Disable or delete any active accounts that have not been used in the last 35 days.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

An account that does not have Administrator duties must not have Administrator rights. Such rights would allow the account to bypass or modify required security restrictions on that machine and make it vulnerable to attack. System administrators must log on to systems only using accounts with the minimum level of authority necessary. For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group (see V-36434 in the Active Directory Domain STIG). Restricting highly privileged accounts from the local Administrators group helps mitigate the risk of privilege escalation resulting from credential theft attacks. Systems dedicated to the management of Active Directory (AD admin platforms, see V-36436 in the Active Directory Domain STIG) are exempt from this. AD admin platforms may use the Domain Admins group or a domain administrative group created specifically for AD admin platforms (see V-43711 in the Active Directory Domain STIG). Standard user accounts must not be members of the local administrators group.

Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Review the members of the Administrators group. Only the appropriate administrator groups or accounts responsible for administration of the system may be members of the group. For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group. Systems dedicated to the management of Active Directory (AD admin platforms, see V-36436 in the Active Directory Domain STIG) are exempt from this. AD admin platforms may use the Domain Admins group or a domain administrative group created specifically for AD admin platforms (see V-43711 in the Active Directory Domain STIG). Standard user accounts must not be members of the local administrator group. If prohibited accounts are members of the local administrators group, this is a finding. The built-in Administrator account or other required administrative accounts would not be a finding.

Configure the system to include only administrator groups or accounts that are responsible for the system in the local Administrators group. For domain-joined workstations, the Domain Admins group must be replaced by a domain workstation administrator group. Systems dedicated to the management of Active Directory (AD admin platforms, see V-36436 in the Active Directory Domain STIG) are exempt from this. AD admin platforms may use the Domain Admins group or a domain administrative group created specifically for AD admin platforms (see V-43711 in the Active Directory Domain STIG). Remove any standard user accounts.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Backup Operators are able to read and write to any file in the system, regardless of the rights assigned to it. Backup and restore rights permit users to circumvent the file access restrictions present on NTFS disk drives for backup and restore purposes. Members of the Backup Operators group must have separate logon accounts for performing backup duties.

Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Review the members of the Backup Operators group. If the group contains no accounts, this is not a finding. If the group contains any accounts, the accounts must be specifically for backup functions. If the group contains any standard user accounts used for performing normal user tasks, this is a finding.

Create separate accounts for backup operations for users with this privilege.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Allowing other operating systems to run on a secure system may allow users to circumvent security. Hyper-V is used by the Credential Guard feature on Windows 10. Preventing users from being assigned to the Hyper-V Administrators group will prevent them from accessing or creating virtual machines on the system.

Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Groups. Double click on "Hyper-V Administrators". If any groups or user accounts are listed in "Members:", this is a finding.

Remove any groups or users from the "Hyper-V Administrators" group.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

To minimize potential points of attack, local user accounts, other than built-in accounts and local administrator accounts, must not exist on a workstation in a domain. Users must log onto workstations in a domain with their domain accounts.

Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. If local users other than the accounts listed below exist on a workstation in a domain, this is a finding. Built-in Administrator account (Disabled) Built-in Guest account (Disabled) Built-in Default Account (Disabled) Local administrator account(s)

Limit local user accounts on domain-joined systems. Remove any unauthorized local accounts.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Unencrypted remote access to a system can allow sensitive information to be compromised. Windows remote management connections must be encrypted to prevent this.

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: AllowUnencryptedTraffic Value Type: REG_DWORD Value: 0

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Allow unencrypted traffic" to "Disabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Passwords that do not expire increase exposure with a greater probability of being discovered or cracked.

Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. Double click each active account. If "Password never expires" is selected for any account, this is a finding.

Configure all passwords to expire. Run "Computer Management". Navigate to System Tools >> Local Users and Groups >> Users. Double click each active account. Ensure "Password never expires" is not checked on all active accounts.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Changing the system's file and directory permissions allows the possibility of unauthorized and anonymous modification to the operating system and installed applications.

The default file system permissions are adequate when the Security Option "Network access: Let Everyone permissions apply to anonymous users" is set to "Disabled" (WN10-SO-000160). If the default file system permissions are maintained and the referenced option is set to "Disabled", this is not a finding. Verify the default permissions for the sample directories below. Non-privileged groups such as Users or Authenticated Users must not have greater than Read & execute permissions except where noted as defaults. (Individual accounts must not be used to assign permissions.) Viewing in File Explorer: Select the "Security" tab, and the "Advanced" button. C:\ Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to Administrators - Full control - This folder, subfolders and files SYSTEM - Full control - This folder, subfolders and files Users - Read & execute - This folder, subfolders and files Authenticated Users - Modify - Subfolders and files only Authenticated Users - Create folders / append data - This folder only \Program Files Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to TrustedInstaller - Full control - This folder and subfolders SYSTEM - Modify - This folder only SYSTEM - Full control - Subfolders and files only Administrators - Modify - This folder only Administrators - Full control - Subfolders and files only Users - Read & execute - This folder, subfolders and files CREATOR OWNER - Full control - Subfolders and files only ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files \Windows Type - "Allow" for all Inherited from - "None" for all Principal - Access - Applies to TrustedInstaller - Full control - This folder and subfolders SYSTEM - Modify - This folder only SYSTEM - Full control - Subfolders and files only Administrators - Modify - This folder only Administrators - Full control - Subfolders and files only Users - Read & execute - This folder, subfolders and files CREATOR OWNER - Full control - Subfolders and files only ALL APPLICATION PACKAGES - Read & execute - This folder, subfolders and files Alternately use icacls. Run "CMD" as administrator. Enter "icacls" followed by the directory. icacls c:\ icacls "c:\program files" icacls c:\windows The following results will be displayed as each is entered: c:\ BUILTIN\Administrators:(OI)(CI)(F) NT AUTHORITY\SYSTEM:(OI)(CI)(F) BUILTIN\Users:(OI)(CI)(RX) NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(M) NT AUTHORITY\Authenticated Users:(AD) Mandatory Label\High Mandatory Level:(OI)(NP)(IO)(NW) Successfully processed 1 files; Failed processing 0 files c:\program files NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) Successfully processed 1 files; Failed processing 0 files c:\windows NT SERVICE\TrustedInstaller:(F) NT SERVICE\TrustedInstaller:(CI)(IO)(F) NT AUTHORITY\SYSTEM:(M) NT AUTHORITY\SYSTEM:(OI)(CI)(IO)(F) BUILTIN\Administrators:(M) BUILTIN\Administrators:(OI)(CI)(IO)(F) BUILTIN\Users:(RX) BUILTIN\Users:(OI)(CI)(IO)(GR,GE) CREATOR OWNER:(OI)(CI)(IO)(F) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(RX) APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(OI)(CI)(IO)(GR,GE) Successfully processed 1 files; Failed processing 0 files

Maintain the default file system permissions and configure the Security Option: "Network access: Let everyone permissions apply to anonymous users" to "Disabled" (WN10-SO-000160).

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Storage of administrative credentials could allow unauthorized access. Disallowing the storage of RunAs credentials for Windows Remote Management will prevent them from being used with plug-ins.

If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\WinRM\Service\ Value Name: DisableRunAs Value Type: REG_DWORD Value: 1

Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Remote Management (WinRM) >> WinRM Service >> "Disallow WinRM from storing RunAs credentials" to "Enabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Installation of Internet Information System (IIS) may allow unauthorized internet services to be hosted. Websites must only be hosted on servers that have been designed for that purpose and can be adequately secured.

IIS is not installed by default. Verify it has not been installed on the system. Run "Programs and Features". Select "Turn Windows features on or off". If the entries for "Internet Information Services" or "Internet Information Services Hostable Web Core" are selected, this is a finding. If an application requires IIS or a subset to be installed to function, this needs be documented with the ISSO. In addition, any applicable requirements from the IIS STIG must be addressed.

Uninstall "Internet Information Services" or "Internet Information Services Hostable Web Core" from the system.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Attackers are constantly looking for vulnerabilities in systems and applications. The Enhanced Mitigation Experience Toolkit can enable several mechanisms, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Structured Exception Handler Overwrite Protection (SEHOP) on the system and applications adding additional levels of protection.

This is applicable to unclassified systems, for other systems this is NA. If EMET has not been installed and DEP and SEHOP are configured as required in V-68845 and V-68849, this is NA. Verify EMET v5.5 or later is installed on the system. If EMET is not installed, or at the minimum required version, this is a finding.

This is applicable to unclassified systems, for other systems this is NA. Install EMET v5.5 or later on the system. EMET is available for download from Microsoft.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Some protocols and services do not support required security features, such as encrypting passwords or traffic.

"SNMP" is not installed by default. Verify it has not been installed. Navigate to the Windows\System32 directory. If the "SNMP" application exists, this is a finding.

Uninstall "Simple Network Management Protocol (SNMP)" from the system. Run "Programs and Features". Select "Turn Windows Features on or off". De-select "Simple Network Management Protocol (SNMP)".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Some protocols and services do not support required security features, such as encrypting passwords or traffic.

"Simple TCP/IP Services" is not installed by default. Verify it has not been installed. Run "Services.msc". If "Simple TCP/IP Services" is listed, this is a finding.

Uninstall "Simple TCPIP Services (i.e. echo, daytime etc)" from the system. Run "Programs and Features". Select "Turn Windows Features on or off". De-select "Simple TCPIP Services (i.e. echo, daytime etc)".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Some protocols and services do not support required security features, such as encrypting passwords or traffic.

The "Telnet Client" is not installed by default. Verify it has not been installed. Navigate to the Windows\System32 directory. If the "telnet" application exists, this is a finding.

Uninstall "Telnet Client" from the system. Run "Programs and Features". Select "Turn Windows Features on or off". De-select "Telnet Client".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Attackers are constantly looking for vulnerabilities in systems and applications. The Enhanced Mitigation Experience Toolkit can enable several mechanisms, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Structured Exception Handler Overwrite Protection (SEHOP) on the system and applications adding additional levels of protection.

This is applicable to unclassified systems, for other systems this is NA. If EMET has not been installed and DEP and SEHOP are configured as required in V-68845 and V-68849, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\EMET\Defaults\ Value Name: *\Internet Explorer\iexplore.exe Value Type: REG_SZ Value: +EAF+ eaf_modules:mshtml.dll;flash*.ocx;jscript*.dll;vbscript.dll;vgx.dll +ASR asr_modules:npjpi*.dll;jp2iexp.dll;vgx.dll;msxml4*.dll;wshom.ocx;scrrun.dll;vbscript.dll asr_zones:1;2 Due to a change in the registry structure for EMET 5.5, if the system has a previous version of EMET installed and configured, this setting needs to be set to "Not Configured" prior to the upgrade to EMET 5.5, and the new administrative template files copied to the appropriate area. The setting can then be re-enabled.

This is applicable to unclassified systems, for other systems this is NA. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> EMET >> "Default Protections for Internet Explorer" to "Enabled". Note: The Enhanced Mitigation Experience Toolkit must be installed on the system and the administrative template files added to make this setting available. Due to a change in the registry structure for EMET 5.5, if the system has a previous version of EMET installed and configured, this setting needs to be set to "Not Configured" prior to the upgrade to EMET 5.5, and the new administrative template files copied to the appropriate area. The setting can then be re-enabled.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Some protocols and services do not support required security features, such as encrypting passwords or traffic.

The "TFTP Client" is not installed by default. Verify it has not been installed. Navigate to the Windows\System32 directory. If the "TFTP" application exists, this is a finding.

Uninstall "TFTP Client" from the system. Run "Programs and Features". Select "Turn Windows Features on or off". De-select "TFTP Client".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Attackers are constantly looking for vulnerabilities in systems and applications. The Enhanced Mitigation Experience Toolkit can enable several mechanisms, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Structured Exception Handler Overwrite Protection (SEHOP) on the system and applications adding additional levels of protection.

This is applicable to unclassified systems, for other systems this is NA. If EMET has not been installed and DEP and SEHOP are configured as required in V-68845 and V-68849, this is NA. If the following registry values do not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\EMET\Defaults\ Value Type: REG_SZ (for each Value below) Values noted as "Blank" are empty in the registry. Value Name: *\7-Zip\7z.exe Value: -EAF Value Name: *\7-Zip\7zG.exe Value: -EAF Value Name: *\7-Zip\7zFM.exe Value: -EAF Value Name: *\Adobe\Adobe Photoshop CS*\Photoshop.exe Value: "Blank" Value Name: *\Foxit Reader\Foxit Reader.exe Value: "Blank" Value Name: *\Google\Chrome\Application\chrome.exe Value: +EAF+ eaf_modules:chrome_child.dll Value Name: *\Google\Google Talk\googletalk.exe Value: -DEP Value Name: *\iTunes\iTunes.exe Value: "Blank" Value Name: *\Microsoft Lync\communicator.exe Value: "Blank" Value Name: *\mIRC\mirc.exe Value: "Blank" Value Name: *\Mozilla Firefox\firefox.exe Value: +EAF+ eaf_modules:mozjs.dll;xul.dll Value Name: *\Mozilla Firefox\plugin-container.exe Value: "Blank" Value Name: *\Mozilla Thunderbird\plugin-container.exe Value: "Blank" Value Name: *\Mozilla Thunderbird\thunderbird.exe Value: "Blank" Value Name: *\Opera\*\opera.exe Value: "Blank" Value Name: *\Opera\opera.exe Value: "Blank" Value Name: *\Pidgin\pidgin.exe Value: "Blank" Value Name: *\QuickTime\QuickTimePlayer.exe Value: "Blank" Value Name: *\Real\RealPlayer\realconverter.exe Value: "Blank" Value Name: *\Real\RealPlayer\realplay.exe Value: "Blank" Value Name: *\Safari\Safari.exe Value: "Blank" Value Name: *\SkyDrive\SkyDrive.exe Value: "Blank" Value Name: *\Skype\Phone\Skype.exe Value: -EAF Value Name: *\VideoLAN\VLC\vlc.exe Value: "Blank" Value Name: *\Winamp\winamp.exe Value: "Blank" Value Name: *\Windows Live\Mail\wlmail.exe Value: "Blank" Value Name: *\Windows Live\Photo Gallery\WLXPhotoGallery.exe Value: "Blank" Value Name: *\Windows Live\Writer\WindowsLiveWriter.exe Value: "Blank" Value Name: *\Windows Media Player\wmplayer.exe Value: -EAF -MandatoryASLR Value Name: *\WinRAR\rar.exe Value: "Blank" Value Name: *\WinRAR\unrar.exe Value: "Blank" Value Name: *\WinRAR\winrar.exe Value: "Blank" Value Name: *\WinZip\winzip32.exe Value: "Blank" Value Name: *\WinZip\winzip64.exe Value: "Blank" Due to a change in the registry structure for EMET 5.5, if the system has a previous version of EMET installed and configured, this setting needs to be set to "Not Configured" prior to the upgrade to EMET 5.5, and the new administrative template files copied to the appropriate area. The setting can then be re-enabled.

This is applicable to unclassified systems, for other systems this is NA. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> EMET >> "Default Protections for Popular Software" to "Enabled". Note: The Enhanced Mitigation Experience Toolkit must be installed on the system and the administrative template files added to make this setting available. Due to a change in the registry structure for EMET 5.5, if the system has a previous version of EMET installed and configured, this setting needs to be set to "Not Configured" prior to the upgrade to EMET 5.5, and the new administrative template files copied to the appropriate area. The setting can then be re-enabled.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Use of software certificates and their accompanying installation files for end users to access resources is less secure than the use of hardware-based certificates.

Search all drives for *.p12 and *.pfx files. If any files with these extensions exist, this is a finding. This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager). Some applications create files with extensions of .p12 that are NOT certificate installation files. Removal of non-certificate installation files from systems is not required. These must be documented with the ISSO.

Remove any certificate installation files (*.p12 and *.pfx) found on a system. Note: This does not apply to server-based applications that have a requirement for .p12 certificate files (e.g., Oracle Wallet Manager).

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Verify the following file is installed and at a version listed or above: McAfee Agent v5.x - masvc.exe McAfee Agent v4.x - FrameworkService.exe The default location is C:\Program Files (x86)\McAfee\Common Framework\ If the McAfee Agent file is not found or at a version specified or above, this is a finding. Run "Services.msc". Verify the corresponding service is running. McAfee Agent v5.x - McAfee Agent Service McAfee Agent v4.x - McAfee Framework Service If the service does not have a Status of "Started", this is a finding.

Deploy the McAfee Agent as detailed in accordance with the DoD HBSS STIG.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Attackers are constantly looking for vulnerabilities in systems and applications. The Enhanced Mitigation Experience Toolkit can enable several mechanisms, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Structured Exception Handler Overwrite Protection (SEHOP) on the system and applications adding additional levels of protection.

This is applicable to unclassified systems, for other systems this is NA. If EMET has not been installed and DEP and SEHOP are configured as required in V-68845 and V-68849, this is NA. If the following registry values do not exist or are not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\EMET\Defaults\ Value Type: REG_SZ (for each Value below) Values noted as "Blank" are empty in the registry. Value Name: *\Adobe\*\Reader\AcroRd32.exe Value: +EAF+ eaf_modules:AcroRd32.dll;Acrofx32.dll;AcroForm.api Value Name: *\Adobe\Acrobat*\Acrobat\Acrobat.exe Value: +EAF+ eaf_modules:AcroRd32.dll;Acrofx32.dll;AcroForm.api Value Name: *\Java\jre*\bin\java.exe Value: -HeapSpray Value Name: *\Java\jre*\bin\javaw.exe Value: -HeapSpray Value Name: *\Java\jre*\bin\javaws.exe Value: -HeapSpray Value Name: *\OFFICE1*\EXCEL.EXE Value: +ASR asr_modules:flash*.ocx Value Name: *\OFFICE1*\INFOPATH.EXE Value: "Blank" Value Name: *\OFFICE1*\LYNC.EXE Value: "Blank" Value Name: *\OFFICE1*\MSACCESS.EXE Value: "Blank" Value Name: *\OFFICE1*\MSPUB.EXE Value: "Blank" Value Name: *\OFFICE1*\OIS.EXE Value: "Blank" Value Name: *\OFFICE1*\OUTLOOK.EXE Value: "Blank" Value Name: *\OFFICE1*\POWERPNT.EXE Value: +ASR asr_modules:flash*.ocx Value Name: *\OFFICE1*\PPTVIEW.EXE Value: "Blank" Value Name: *\OFFICE1*\VISIO.EXE Value: "Blank" Value Name: *\OFFICE1*\VPREVIEW.EXE Value: "Blank" Value Name: *\OFFICE1*\WINWORD.EXE Value: +ASR asr_modules:flash*.ocx Value Name: *\Windows NT\Accessories\wordpad.exe Value: "Blank" Due to a change in the registry structure for EMET 5.5, if the system has a previous version of EMET installed and configured, this setting needs to be set to "Not Configured" prior to the upgrade to EMET 5.5, and the new administrative template files copied to the appropriate area. The setting can then be re-enabled.

This is applicable to unclassified systems, for other systems this is NA. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> EMET >> "Default Protections for Recommended Software" to "Enabled". Note: The Enhanced Mitigation Experience Toolkit must be installed on the system and the administrative template files added to make this setting available. Due to a change in the registry structure for EMET 5.5, if the system has a previous version of EMET installed and configured, this setting needs to be set to "Not Configured" prior to the upgrade to EMET 5.5, and the new administrative template files copied to the appropriate area. The setting can then be re-enabled.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

A firewall provides a line of defense against attack, allowing or blocking inbound and outbound connections based on a set of rules.

Determine if a host-based firewall is installed and enabled on the system. If a host-based firewall is not installed and enabled on the system, this is a finding. The configuration requirements will be determined by the applicable firewall STIG.

Install and enable a host-based firewall on the system.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Attackers are constantly looking for vulnerabilities in systems and applications. The Enhanced Mitigation Experience Toolkit can enable several mechanisms, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Structured Exception Handler Overwrite Protection (SEHOP) on the system and applications adding additional levels of protection.

This is applicable to unclassified systems, for other systems this is NA. If EMET has not been installed and DEP and SEHOP are configured as required in V-68845 and V-68849, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\EMET\SysSettings\ Value Name: ASLR Value Type: REG_DWORD Value: 3

This is applicable to unclassified systems, for other systems this is NA. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> EMET >> "System ASLR" to "Enabled" with "Application Opt In" selected. Note: The Enhanced Mitigation Experience Toolkit must be installed on the system and the administrative template files added to make this setting available.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Allowing inbound access to domain workstations from other systems may allow lateral movement across systems if credentials are compromised. Limiting inbound connections only from authorized remote management systems will help limit this exposure.

Verify firewall exceptions to inbound connections on domain workstations include only authorized remote management hosts. If allowed inbound exceptions are not limited to authorized remote management hosts, this is a finding. Review inbound firewall exceptions. Computer Configuration >> Windows Settings >> Security Settings >> Windows Firewall with Advanced Security >> Windows Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane) For any inbound rules that allow connections view the Scope for Remote IP address. This may be defined as an IP address, subnet, or range. The rule must apply to all firewall profiles. If a third-party firewall is used, ensure comparable settings are in place.

Configure firewall exceptions to inbound connections on domain workstations to include only authorized remote management hosts. Configure only inbound connection exceptions for authorized remote management hosts. Computer Configuration >> Windows Settings >> Security Settings >> Windows Firewall with Advanced Security >> Windows Firewall with Advanced Security >> Inbound Rules (this link will be in the right pane) For any inbound rules that allow connections, configure the Scope for Remote IP address to those of authorized remote management hosts. This may be defined as an IP address, subnet or range. Apply the rule to all firewall profiles. If a third-party firewall is used, configure inbound exceptions to only include authorized remote management hosts.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the amount of time that an account will remain locked after the specified number of failed logon attempts. A value of 0 will require an administrator to unlock the account.

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Account lockout duration" is not set to "0", requiring an administrator to unlock the account, this is a finding.

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout duration" to "0" minutes, "Account is locked out until administrator unlocks it".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Attackers are constantly looking for vulnerabilities in systems and applications. The Enhanced Mitigation Experience Toolkit can enable several mechanisms, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Structured Exception Handler Overwrite Protection (SEHOP) on the system and applications adding additional levels of protection.

This is applicable to unclassified systems, for other systems this is NA. If EMET has not been installed and DEP and SEHOP are configured as required in V-68845 and V-68849, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\EMET\SysSettings\ Value Name: DEP Value Type: REG_DWORD Value: 2 (Application Opt Out) Applications that do not function properly due to this setting, and are opted out, must be documented with the ISSO.

This is applicable to unclassified systems, for other systems this is NA. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> EMET >> "System DEP" to "Enabled" with at least "Application Opt Out" selected. Note: The Enhanced Mitigation Experience Toolkit must be installed on the system and the administrative template files added to make this setting available. Document applications that do not function properly due to this setting, and are opted out, with the ISSO. Opted out exceptions can be configured with the following command. EMET_Conf --Set "application path\executable name" -DEP Alternately, configured exceptions in System Properties. Select "System" in Control Panel. Select "Advanced system settings". Click "Settings" in the "Performance" section. Select the "Data Execution Prevention" tab. Select "Turn on DEP for all programs and services except those I select:". Applications that are opted out are configured in the window below this selection.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

The account lockout feature, when enabled, prevents brute-force password attacks on the system. The higher this value is, the less effective the account lockout feature will be in protecting the local system. The number of bad logon attempts must be reasonably small to minimize the possibility of a successful password attack, while allowing for honest errors made during a normal user logon.

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Account lockout threshold" is "0" or more than "3" attempts, this is a finding.

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Account lockout threshold" to "3" or less invalid logon attempts (excluding "0" which is unacceptable).

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Attackers are constantly looking for vulnerabilities in systems and applications. The Enhanced Mitigation Experience Toolkit can enable several mechanisms, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Structured Exception Handler Overwrite Protection (SEHOP) on the system and applications adding additional levels of protection.

This is applicable to unclassified systems, for other systems this is NA. If EMET has not been installed and DEP and SEHOP are configured as required in V-68845 and V-68849, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\EMET\SysSettings\ Value Name: SEHOP Value Type: REG_DWORD Value: 2 Applications that do not function properly due to this setting, and are opted out, must be documented with the ISSO.

This is applicable to unclassified systems, for other systems this is NA. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> EMET >> "System SEHOP" to "Enabled" with "Application Opt Out" selected. Note: The Enhanced Mitigation Experience Toolkit must be installed on the system and the administrative template files added to make this setting available. Document applications that do not function properly due to this setting, and are opted out, with the ISSO. Opted out exceptions can be configured with the following command. EMET_Conf --Set "application path\executable name" -SEHOP

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

The account lockout feature, when enabled, prevents brute-force password attacks on the system. This parameter specifies the period of time that must pass after failed logon attempts before the counter is reset to 0. The smaller this value is, the less effective the account lockout feature will be in protecting the local system.

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy. If the "Reset account lockout counter after" value is less than "15" minutes, this is a finding.

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy >> "Reset account lockout counter after" to "15" minutes.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

A system is more vulnerable to unauthorized access when system users recycle the same password several times without being required to change a password to a unique password on a regularly scheduled basis. This enables users to effectively negate the purpose of mandating periodic password changes. The default value is 24 for Windows domain systems. DoD has decided this is the appropriate value for all Windows systems.

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Enforce password history" is less than "24" passwords remembered, this is a finding.

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Enforce password history" to "24" passwords remembered.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Attackers are constantly looking for vulnerabilities in systems and applications. The Enhanced Mitigation Experience Toolkit can enable several mechanisms, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Structured Exception Handler Overwrite Protection (SEHOP) on the system and applications adding additional levels of protection. This setting enables the Deep Hooks mitigation on a system which protects lower level APIs that are used by critical top level APIs.

This is applicable to unclassified systems, for other systems this is NA. If EMET has not been installed and DEP and SEHOP are configured as required in V-68845 and V-68849, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\EMET\SysSettings\ Value Name: DeepHooks Value Type: REG_DWORD Value: 1

This is applicable to unclassified systems, for other systems this is NA. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> EMET >> "Default Actions and Mitigation Settings" to "Enabled" with "Enabled" selected for "Deep Hooks:". Note: The Enhanced Mitigation Experience Toolkit must be installed on the system and the administrative template files added to make this setting available.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the passwords. Scheduled changing of passwords hinders the ability of unauthorized system users to crack passwords and gain access to a system.

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Maximum password age" is greater than "60" days, this is a finding. If the value is set to "0" (never expires), this is a finding.

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Maximum Password Age" to "60" days or less (excluding "0" which is unacceptable).

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Permitting passwords to be changed in immediate succession within the same day allows users to cycle passwords through their history database. This enables users to effectively negate the purpose of mandating periodic password changes.

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Minimum password age" is less than "1" day, this is a finding.

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum Password Age" to at least "1" day.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Information systems not protected with strong password schemes (including passwords of minimum length) provide the opportunity for anyone to crack the password, thus gaining access to the system and compromising the device, information, or the local network.

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for the "Minimum password length," is less than "14" characters, this is a finding.

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Minimum password length" to "14" characters.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Attackers are constantly looking for vulnerabilities in systems and applications. The Enhanced Mitigation Experience Toolkit can enable several mechanisms, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Structured Exception Handler Overwrite Protection (SEHOP) on the system and applications adding additional levels of protection. This setting enables the Anti detours mitigation on a system which prevents exploits from evading hooks functions.

This is applicable to unclassified systems, for other systems this is NA. If EMET has not been installed and DEP and SEHOP are configured as required in V-68845 and V-68849, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\EMET\SysSettings\ Value Name: AntiDetours Value Type: REG_DWORD Value: 1

This is applicable to unclassified systems, for other systems this is NA. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> EMET >> "Default Actions and Mitigation Settings" to "Enabled" with "Enabled" selected for "Anti Detours:". Note: The Enhanced Mitigation Experience Toolkit must be installed on the system and the administrative template files added to make this setting available.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

The use of complex passwords increases their strength against guessing and brute-force attacks. This setting configures the system to verify that newly created passwords conform to the Windows password complexity policy.

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Password must meet complexity requirements" is not set to "Enabled", this is a finding. If the site is using a password filter that requires this setting be set to "Disabled" for the filter to be used, this would not be considered a finding.

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Password must meet complexity requirements" to "Enabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Storing passwords using reversible encryption is essentially the same as storing clear-text versions of the passwords. For this reason, this policy must never be enabled.

Verify the effective setting in Local Group Policy Editor. Run "gpedit.msc". Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy. If the value for "Store password using reversible encryption" is not set to "Disabled", this is a finding.

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Password Policy >> "Store passwords using reversible encryption" to "Disabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Credential validation records events related to validation tests on credentials for a user account logon.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Logon >> Credential Validation - Failure

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Failure" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Attackers are constantly looking for vulnerabilities in systems and applications. The Enhanced Mitigation Experience Toolkit can enable several mechanisms, such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Structured Exception Handler Overwrite Protection (SEHOP) on the system and applications adding additional levels of protection. This setting enables the Banned functions mitigation on a system which blocks certain APIs.

This is applicable to unclassified systems, for other systems this is NA. If EMET has not been installed and DEP and SEHOP are configured as required in V-68845 and V-68849, this is NA. If the following registry value does not exist or is not configured as specified, this is a finding: Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\EMET\SysSettings\ Value Name: BannedFunctions Value Type: REG_DWORD Value: 1

This is applicable to unclassified systems, for other systems this is NA. Configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> EMET >> "Default Actions and Mitigation Settings" to "Enabled" with "Enabled" selected for "Banned Functions:". Note: The Enhanced Mitigation Experience Toolkit must be installed on the system and the administrative template files added to make this setting available.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Credential validation records events related to validation tests on credentials for a user account logon.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Logon >> Credential Validation - Success

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Logon >> "Audit Credential Validation" with "Success" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Windows Error Reporting information can be used to help diagnose day-to-day software issues, as well as help discover malicious code and possibly zero-day attacks on systems.

Verify the Start Type and Status of the Windows Error Reporting Service. Run "Services.msc". If the Windows Error Reporting Service does not have a Status of "Running" and a Start Type of "Automatic", this is a finding.

Configure the Start Type of the Windows Error Reporting Service to "Automatic" and ensure the service has a status of "Running".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Other Account Management records events such as the access of a password hash or the Password Policy Checking API being called.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Management >> Other Account Management Events - Failure

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Other Account Management Events" with "Failure" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Other Account Management records events such as the access of a password hash or the Password Policy Checking API being called.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Management >> Other Account Management Events - Success

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Other Account Management Events" with "Success" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Security Group Management records events such as creating, deleting or changing of security groups, including changes in group members.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Management >> Security Group Management - Failure

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Security Group Management" with "Failure" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Security Group Management records events such as creating, deleting or changing of security groups, including changes in group members.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Management >> Security Group Management - Success

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit Security Group Management" with "Success" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Management >> User Account Management - Failure

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Failure" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. User Account Management records events such as creating, changing, deleting, renaming, disabling, or enabling user accounts.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Account Management >> User Account Management - Success

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Account Management >> "Audit User Account Management" with "Success" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Plug and Play activity records events related to the successful connection of external devices.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Detailed Tracking >> Plug and Play Events - Success

Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit PNP Activity" with "Success" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Process creation records events related to the creation of a process and the source.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Detailed Tracking >> Process Creation - Success

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Detailed Tracking >> "Audit Process Creation" with "Success" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Account Lockout events can be used to identify potentially malicious logon attempts.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Account Lockout - Success

Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" with "Success" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Audit Group Membership records information related to the group membership of a user's logon token.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*" Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Group Membership - Success

Computer Configuration >> Windows Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Group Membership" with "Success" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Logoff records user logoffs. If this is an interactive logoff, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Logoff - Success

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logoff" with "Success" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Enabling Windows Error Reporting generates information useful to system administrators and forensics analysts for diagnosing system problems and investigating intrusions. If Windows Error Reporting is turned off, valuable system diagnostic and vulnerability information may be lost.

The default behavior for Windows Error Reporting is to send error reports. If the registry value name below does not exist, this is not a finding. If it exists and is configured with a value of "0", this is not a finding. If it exists and is configured with a value of "1", this is a finding. Registry Hive: HKEY_LOCAL_MACHINE Registry Path: \SOFTWARE\Policies\Microsoft\Windows\Windows Error Reporting\ Value Name: Disabled Value Type: REG_DWORD Value: 0 (or if the Value Name does not exist)

The default behavior for Windows Error Reporting is to send error reports. If this needs to be corrected, configure the policy value for Computer Configuration >> Administrative Templates >> Windows Components >> Windows Error Reporting >> "Disable Windows Error Reporting" to "Disabled".

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Logon - Failure

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Failure" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885

Maintaining an audit trail of system activity logs can help identify configuration errors, troubleshoot service disruptions, and analyze compromises that have occurred, as well as detect attacks. Audit logs are necessary to provide a trail of evidence in case the system or network is compromised. Collecting this data is essential for analyzing the security of information assets and detecting signs of suspicious and unexpected behavior. Logon records user logons. If this is an interactive logon, it is recorded on the local system. If it is to a network share, it is recorded on the system accessed.

Security Option "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" must be set to "Enabled" (WN10-SO-000030) for the detailed auditing subcategories to be effective. Use the AuditPol tool to review the current Audit Policy configuration: Open a Command Prompt with elevated privileges ("Run as Administrator"). Enter "AuditPol /get /category:*". Compare the AuditPol settings with the following. If the system does not audit the following, this is a finding: Logon/Logoff >> Logon - Success

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Logon" with "Success" selected.

title: DPMS Target Windows 10
publisher: DISA
type: DPMS Target
subject: Windows 10
identifier: 2885